DPDK vhost CVE-2026-86567

Exploitation requires the host to be running DPDK's vhost library with the VDUSE (vDPA Device in USErspace) backend in use, and the attacker must control a VDUSE device backend or a guest capable of driving IOTLB invalidations on the vhost device - this is the exact triggering condition. Limiting factors: the CVSS vector is AV:L (local access to the host/device plane, not network-reachable) and PR:L (some privilege/access to the vhost or guest interface is required, not fully unauthenticated); deployments not using VDUSE/vhost-user with IOTLB are not exposed. This materially confines exploitation to multi-tenant virtualization and NFV hosts that specifically enable DPDK VDUSE.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) describes a locally-reachable, low-complexity, low-privilege use-after-free with a scope change and full CIA impact - the scope change (S:C) is the key signal, consistent with a guest/userspace VDUSE device compromising the host vhost process trust boundary. However, the attack vector is LOCAL (AV:L), so this is not a remotely-reachable internet-facing flaw; realistic risk is confined to environments where an attacker already controls a guest VM or a VDUSE userspace device backend. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploitation signal - this is a vendor-reported (Red Hat) flaw with no public exploit identified at time of analysis. The CWE-416 use-after-free with C:H/I:H/A:H plausibly enables host-side memory corruption and potential code execution, but exploiting a UAF in the DPDK vhost library to reliable code execution is non-trivial, tempering the raw 8.8. Net: a genuine high-severity local privilege-escalation/VM-escape-class issue worth prioritizing in multi-tenant/NFV hosts running OVS-DPDK with VDUSE, but NOT an urgent mass-exploitation threat given local-only vector and absence of any exploitation evidence.

An attacker controlling a malicious VDUSE userspace device backend (or a compromised guest driving one) triggers an IOTLB invalidation while retaining stale vring pointers in the DPDK vhost handler, then forces the host vhost process to dereference the now-unmapped memory. By grooming the freed region, the attacker corrupts host memory to crash the data-plane process or execute code in the host vhost context, crossing the guest/device-to-host boundary (S:C). No public exploit was identified at time of analysis.